What is the difference between these SQLi queries?

Question

I was performing a Web Pentest and I found this when i was doing sqli in a search field:

' or  1=1--     returns 15 results
' or '1'='1     returns 30 different results
' or '1'='1--   returns 0 results

What may be the cause? I mean, what is the difference between those queries?

Answer 1

There are some details which I would have wanted for a better understanding, but I'm assuming that you are trying to send malicious SQLi in a search parameter.

Let me use an example that you are searching for the term 'shoes'

The web request for that might be: www.example.com/search.php?tag=shoes

The SQL query for that request might use LIKE. I have used LIKE specifically because you are targetting search box. It would be a rare case or a very app-specific case where instead of LIKE, a direct comparison (=) is done.

SELECT * FROM table_name WHERE searchtext LIKE 'shoes' AND SOME_CONDITION

Now let's insert your given SQL queries:

1) ' or 1=1-- -> This will convert the query to SELECT * FROM table_name where searchtext LIKE '' or 1=1 . Rest of the query gets commented out.

2) ' or '1'='1 -> This will convert the query to SELECT * from table_name where searchtext LIKE '' or '1'='1' AND SOME_CONDITION . This causes a different query to execute than above. Depending on the condition or the subquery the results will be altered.

3) ' or '1'='1-- -> This will convert the query to SELECT * from table_name where searchtext LIKE '' or '1'='1 . Its an INVALID QUERY. This query should not execute as the quotes are imbalanced. The application might be handling exceptions, hence you are able to see 0 results, otherwise, you would have seen SQL error on your web app.

Answer 2

The reason for the different results is that your first injection cuts off the rest of the query via the comment (--).

Your last injection likely returns nothing because it is invalid and causes an error (because of the unclosed ').

The query in which you are injecting likely has a structure like this:

... WHERE foo='your input' OR bar='something else'

It doesn't have to be exactly like this, but we do know that there has to be something after the point in which you are injecting.

_{Of course, theoretically it could also be that the search legitimately returns those results and there is no injection at all (in this case it's unlikely though). You should try other injections as well, such as ' and '1'='1, ' and sleep(10)-- -, actually extracting data, etc.}